explorer.exe and c:\trace.txt

[vengy1]

Using filemon, it seems explorer.exe does some weird file commands to c:\trace.txt

--- C:\trace.txt ---
0
0
0
0
0
0


which is repeated each time I close a windows explorer session. Any ideas why this is happening? Thanks!

77 8:27:58 PM explorer.exe:1392 OPEN C:\trace.txt SUCCESS Options: OpenIf Access: All
78 8:27:58 PM explorer.exe:1392 QUERY INFORMATION C:\trace.txt SUCCESS Length: 15
79 8:27:58 PM explorer.exe:1392 QUERY INFORMATION C:\trace.txt SUCCESS Length: 15
80 8:27:58 PM explorer.exe:1392 WRITE C:\trace.txt SUCCESS Offset: 15 Length: 3
81 8:27:58 PM explorer.exe:1392 CLOSE C:\trace.txt SUCCESS

 

[erikhertzel]

Looking at this I would recommend looking for malware:

Webroot Spysweeper

Download it here:

http://www.sabethacomputing.com/downloads.html

Webroot Spysweeper 14 day Trial

Update the defs and do a sweep.

Also check this out:

Ewido download:

http://www.ewido.net/en

Update it and run a complete scan.


I would also check it with some other virus scanners just to make sure.

http://housecall.trendmicro.com

http://www.pandasoftware.com/activescan

Let us know what you find.

Erik